Token Security Weaknesses in NHI-Based AI Agent Platforms

Token security in non-human identity (NHI) platforms is not just a problem of stolen keys. AI agents inherit credentials built around human supervision, then use them without its constraints. Overprivileged access, long-lived secrets, missing lifecycle triggers, and absent behavioral baselines follow from that mismatch. Securing agents therefore requires more than better token housekeeping. It requires controls that govern what agents do while they are doing it.

Why the token model built for humans is the wrong foundation for AI agents

Human identity and access management (IAM) grew around a recognizable actor. A person has a manager, works reasonably predictable hours, completes multifactor authentication (MFA), and can explain an unusual action. Those assumptions provide context around a credential. An autonomous agent supplies none of them by default, yet the credential infrastructure often treats its access as though the same supervision exists.

The Cloud Security Alliance’s 2026 whitepaper, The Non-Human Identity Governance Vacuum, documents NHIs outnumbering human identities by an average of 45 to 1 in enterprise environments, reaching 144 to 1 in cloud-native deployments [1][2]. Governance rigor has not grown at the same pace. But scale is only part of the mismatch. Agents acquire permissions at runtime, spawn sub-agents, invoke external APIs, write and execute code, and chain actions across dozens of systems. A static service account does not put that sequence together on its own.

Kurtz & Krawiecka (2026) identify four capability dimensions that expand the governance surface, namely tool invocation, multi-step autonomous execution, agent-to-agent delegation, and environmental interaction with persistent memory. Authorization must handle actions whose scope changes as they run, even after access has been granted.

The four structural token weaknesses specific to agentic architectures

Overprivileged credentials result when provisioning systems give agents broad access without a way to tie it to a task or to what the agent is doing. An agent may have credentials for CRM, email, cloud infrastructure, and payment systems all at once. That creates a broad exposure surface before any compromise. Kurtz & Krawiecka identify tool invocation as a primary route for privilege abuse and exfiltration because every API call is an authenticated action under the agent’s identity. Broad provisioning makes those permissions available to malicious actions as well as legitimate ones.

Long-lived secrets add time to that reach. Organizations make people follow password rotation rules but let API keys and service account credentials last for years because rotation can break production systems. Yet a valid, long-lived JWT can be replayed for direct account access while bypassing MFA. The credential itself becomes the authentication bypass.

Human onboarding, role changes, and offboarding create recognizable occasions for credential review, whereas agents have no equivalent events by default. The CSA whitepaper calls this the “governance tail” pattern. Identities outlive their operational context and accumulate permissions that no human owner can fully account for. Expiry is missing not only from the secret, but from the organizational understanding of why it exists.

Human monitoring uses expected login times, locations, and volumes, but an agent’s hours, task scope, and action patterns may not be predetermined. Kurtz & Krawiecka describe the challenge as one of behavioral trajectory. Individually authorized steps can combine into an outcome that no single authorization decision contemplated. A valid token establishes permission for an action, leaving the developing sequence’s alignment with the intended task unresolved.

How multi-agent orchestration turns each weakness into a multiplier

Delegation joins these weaknesses into a chain of authority. Each boundary between agents can become a privilege escalation surface, while sub-agents inherit their parent’s credential assumptions. The CSA whitepaper distinguishes agent-to-agent delegation from earlier NHI categories such as service accounts and API keys. Access can support downstream actors whose work extends the consequences of the original grant.

The CSA’s 2026 token sprawl analysis uses “persistent blast radius” for credentials that outlive their operational context. In a multi-agent chain, one long-lived, overprivileged token can extend that radius through every downstream agent that inherits or uses it. Missing lifecycle triggers leave that access in place, while the lack of behavioral baselines makes it harder to judge where the chain is heading.

Ruan’s 2026 working paper describes cascading failures in which upstream errors propagate through multi-step workflows and cause system-wide collapse. The paper, which has not been peer-reviewed, offers a useful architectural distinction. A failure at one node need not stay there. The Agent Security Bench (ASB, ICLR 2025), which Ruan cites, reports that mixed attacks had an average attack success rate of 84.30% across scenarios based on how agents are used in the real world. That benchmark indicates substantial defensive weakness under adversarial pressure within the tested scenarios.

Documented attacks that exploited these structural weaknesses in production

CVE-2026-59822 exposed a particularly direct failure in LiteLLM’s MCP server. A fallback treated a failed authentication check as an anonymous but authenticated caller, allowing a fabricated Bearer token to open a session. The flaw affected versions below LiteLLM 1.84.0, and exposed proxies that accepted the default master key gave attackers more pre-authentication paths to compromise cloud systems. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2 September 2026, with a 16 September remediation deadline for federal civilian agencies.

The Salesloft-Drift OAuth supply-chain attack in 2025 demonstrated how stolen credentials extend compromise across organizational boundaries. An attacker used stolen OAuth tokens to reach more than 700 downstream customer environments. Long-lived secrets and broad permissions compounded the exposure. The January 2026 Moltbook database exposure showed the inventory side of the same governance problem, with an open Supabase database exposing 1.5 million AI agent API keys. When credentials have no owners, expiry, or monitoring, there is little in place to prevent attacks or respond to them.

The Carbonato Botnet deployed an AI agent on exposed Docker hosts in 2026 to harvest AI API keys and power its operation. In June 2026, the Miasma and Hades worms used stolen GitHub accounts, OIDC publishing tokens, and npm and PyPI tokens to spread credential theft. The worms reached Microsoft repositories through a contributor account that had been compromised again and was used to push malicious AI coding tool configuration files. Long-lived CI/CD tokens provided persistent footholds where lifecycle governance had not removed access.

Malicious AGENTS.md files caused OpenAI Codex to execute attacker-defined commands, including installing a rogue npm package and rewriting its MCP server configuration. A separate malicious CLAUDE.md redirected Claude Code’s API traffic to an attacker-controlled server, exposing OAuth tokens. Controlled tests reached success rates as high as 90% against Codex, while the token-theft variant against Claude Code succeeded in roughly 50% of tests. These test results show why trusted credentials require a complementary model of expected behavior.

The September 2026 Google Cloud / DUSTMAKER case showed the operational reach of attacker-directed autonomy. Attackers used an AI coding chatbot with preconfigured instructions to guide agents through vulnerability scanning, credential collection, troubleshooting, and IP rotation. Constant human decisions were no longer required. Beyond token theft, this case shows why monitoring must check what agents do, even when they act through an authenticated workflow.

Why the governance frameworks organizations currently apply do not reach the agent layer

The organizational gap is not adequately explained by negligence. Existing tools largely reflect human behavior and human lifecycle events, so applying them diligently still leaves parts of agent activity outside their reach. The CSA whitepaper finds that more than 16% of organizations do not track the creation of AI-related identities at all. Only a few feel very sure they can prevent NHI-based attacks. Most express concern, which is not the same thing as having a control.

Research cited by the NHI Management Group and the CSA whitepaper finds that 92% agree agent governance is critical to enterprise security, while only 44% have implemented any policies for it. The CSA’s 2026 findings also show that more than half of organizations report agents acting beyond their intended scope. Those actions include accessing unauthorized systems, inappropriately sharing sensitive data, and revealing credentials.

Ruan describes the underlying deficiency as the absence of a formal Separation of Power model. A single agent sets its plan and executes it, leaving authority concentrated in the actor being governed. An audit can record that arrangement without constraining it. The NIST NCCoE Concept Paper from February 2026 proposes a demonstration project for agent identity and authorization, but has not yet produced enforceable controls.

The limits of the leading prescriptions: JIT credentials and extended IAM

Just-in-time (JIT) credential provisioning improves on credentials left available indefinitely. It supplies an issuance lifecycle and reduces the exposure window associated with long-lived secrets. But shorter validity does not reduce the permissions inside a token. A short-lived credential can still authorize broad access if the underlying identity was never designed for task-scoped use. In a multi-agent workflow, ephemeral credentials at one node also do not prevent another node from supplying inherited, long-lived access.

Extended IAM addresses a different part of the problem. Some practitioners want to use role-based and attribute-based models with NHI-specific overlays, while others want to replace them with goal-scoped authorization. Neither position has dominant empirical support as of late 2026. Microsoft’s Agent Governance Toolkit, open-sourced in April 2026, offers purpose-built components including Agent OS for stateless policy, Agent Runtime for execution rings and runtime sandboxing, Agent Mesh for cryptographic identity, and MCP security gateways. That is a meaningful engineering step, but an open-source toolkit is not an enterprise governance standard.

The disagreement also concerns what, exactly, should be governed. Nannini et al. (2026) identify privilege minimization outside the generative model as an agent-specific compliance challenge, distinct from controls on the model itself. Governing a token, session, agent, task, or chain produces different boundaries for enforcement. Actual task scope should determine token lifespan, taking precedence over operational convenience. The unresolved difficulty is that an autonomous agent’s full task scope may not be known when its credentials are provisioned.

What governance capable of reaching the agent layer actually requires

A sufficient response must treat agent identity as a dynamic signal that is continuously validated, rather than a static credential accepted until expiry. Behavioral baseline construction must begin at provisioning, with its absence treated as a policy violation. A system cannot identify a departure from purpose if it has never defined the purpose.

Lifecycle governance must also account for what agents are doing, alongside calendar-based rotation. When an agent’s task ends, its credentials must be decommissioned. Delegation makes that obligation extend beyond the parent. Decommissioning a parent agent must trigger review of the sub-agents and downstream tokens it provisioned or shared. Provisioning must also reflect actual tool invocation scope, aiming to make excess privilege structurally unavailable.

Ruan argues that safety must become a structural property of the system, shifting its cost away from individual participants. Logs serve a different purpose from preventive controls. They support accountability after an action, but do not stop the action being recorded. The NCCoE paper proposes integrating MCP, Next Generation Access Control, SP 800-207 Zero Trust, and federated identity frameworks into agentic architectures, pointing toward controls that operate where agents act.

Nannini et al. conclude that high-risk agentic systems with untraceable behavioral drift cannot currently satisfy the essential requirements of the EU AI Act. CISA’s remediation mandate addresses exploited infrastructure, while the NIST work develops approaches to agent authorization. Together, they sharpen the practical requirement for real-time visibility, enforceable limits, and traceable actions. The remaining gap is not whether an organization can document an agent’s authority, but whether it can constrain that authority before misuse becomes an incident.